PT-2017-2789 · Google · Android

Published 2017-06-07 · Updated 2023-11-21 · CVE-2017-0785

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Android versions 4.4.4 through 8.0

Description A information disclosure vulnerability in the Android system's bluetooth component allows an attacker to send a set of requests to a server and disclose a bit of memory in the response. The obtained information can be used to bypass security measures and gain control over the device using other vulnerabilities. The issue is caused by a buffer overflow when implementing the Service Discovery Protocol (SDP).

Recommendations For Android versions 4.4.4 through 8.0, update to a version that contains a fix for this issue, as no specific workaround is provided for these versions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Out of bounds Read

Weakness Enumeration

CWE-200

CWE-125

Related Identifiers

BDU:2017-02052

CVE-2017-0785

Affected Products

Android

References · 21

• 🔥 https://github.com/ojasookert/CVE-2017-0785 · Exploit
• 🔥 https://github.com/Alfa100001/-CVE-2017-0785-BlueBorne-PoC · Exploit
• 🔥 https://github.com/pieterbork/blueborne · Exploit
• 🔥 https://exploit-db.com/exploits/44555 · Exploit
• https://source.android.com/security/bulletin/2017-09-01 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-02052 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-0785 · Security Note
• https://osv.dev/vulnerability/CVE-2017-0785 · Vendor Advisory
• https://habrahabr.ru/company/cloud4y/blog/337782 · Note
• http://go.armis.com/hubfs/BlueBorne%20Technical%20White%20Paper.pdf · Note
• http://oracle.com/technetwork/security-advisory/cpujul2018-4258247.html · Note
• http://oracle.com/technetwork/security-advisory/cpujan2018-3236628.html · Note
• https://android.googlesource.com/platform/system/bt/+/226ea26684d4cd609a5b456d3d2cc762453c2d75 · Note
• http://securityfocus.com/bid/100812 · Note
• https://t.me/breachdetector/383146 · Telegram Post